6603523bf5
There are two problems in crypto_spawn_alg. First of all it may return spawn->alg even if spawn->dead is set. This results in a double-free as detected by syzbot. Secondly the setting of the DYING flag is racy because we hold the read-lock instead of the write-lock. We should instead call crypto_shoot_alg in a safe manner by gaining a refcount, dropping the lock, and then releasing the refcount. This patch fixes both problems. Reported-by: syzbot+fc0674cde00b66844470@syzkaller.appspotmail.com Fixes:4f87ee118d("crypto: api - Do not zap spawn->alg") Fixes:73669cc556("crypto: api - Fix race condition in...") Cc: <stable@vger.kernel.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
130 lines
3.3 KiB
C
130 lines
3.3 KiB
C
/* SPDX-License-Identifier: GPL-2.0-or-later */
|
|
/*
|
|
* Cryptographic API.
|
|
*
|
|
* Copyright (c) 2002 James Morris <jmorris@intercode.com.au>
|
|
* Copyright (c) 2005 Herbert Xu <herbert@gondor.apana.org.au>
|
|
*/
|
|
#ifndef _CRYPTO_INTERNAL_H
|
|
#define _CRYPTO_INTERNAL_H
|
|
|
|
#include <crypto/algapi.h>
|
|
#include <linux/completion.h>
|
|
#include <linux/mm.h>
|
|
#include <linux/highmem.h>
|
|
#include <linux/interrupt.h>
|
|
#include <linux/init.h>
|
|
#include <linux/list.h>
|
|
#include <linux/module.h>
|
|
#include <linux/kernel.h>
|
|
#include <linux/notifier.h>
|
|
#include <linux/rwsem.h>
|
|
#include <linux/slab.h>
|
|
|
|
struct crypto_instance;
|
|
struct crypto_template;
|
|
|
|
struct crypto_larval {
|
|
struct crypto_alg alg;
|
|
struct crypto_alg *adult;
|
|
struct completion completion;
|
|
u32 mask;
|
|
};
|
|
|
|
extern struct list_head crypto_alg_list;
|
|
extern struct rw_semaphore crypto_alg_sem;
|
|
extern struct blocking_notifier_head crypto_chain;
|
|
|
|
#ifdef CONFIG_PROC_FS
|
|
void __init crypto_init_proc(void);
|
|
void __exit crypto_exit_proc(void);
|
|
#else
|
|
static inline void crypto_init_proc(void)
|
|
{ }
|
|
static inline void crypto_exit_proc(void)
|
|
{ }
|
|
#endif
|
|
|
|
static inline unsigned int crypto_cipher_ctxsize(struct crypto_alg *alg)
|
|
{
|
|
return alg->cra_ctxsize;
|
|
}
|
|
|
|
static inline unsigned int crypto_compress_ctxsize(struct crypto_alg *alg)
|
|
{
|
|
return alg->cra_ctxsize;
|
|
}
|
|
|
|
struct crypto_alg *crypto_mod_get(struct crypto_alg *alg);
|
|
struct crypto_alg *crypto_alg_mod_lookup(const char *name, u32 type, u32 mask);
|
|
|
|
struct crypto_larval *crypto_larval_alloc(const char *name, u32 type, u32 mask);
|
|
void crypto_larval_kill(struct crypto_alg *alg);
|
|
void crypto_alg_tested(const char *name, int err);
|
|
|
|
void crypto_remove_spawns(struct crypto_alg *alg, struct list_head *list,
|
|
struct crypto_alg *nalg);
|
|
void crypto_remove_final(struct list_head *list);
|
|
void crypto_shoot_alg(struct crypto_alg *alg);
|
|
struct crypto_tfm *__crypto_alloc_tfm(struct crypto_alg *alg, u32 type,
|
|
u32 mask);
|
|
void *crypto_create_tfm(struct crypto_alg *alg,
|
|
const struct crypto_type *frontend);
|
|
struct crypto_alg *crypto_find_alg(const char *alg_name,
|
|
const struct crypto_type *frontend,
|
|
u32 type, u32 mask);
|
|
void *crypto_alloc_tfm(const char *alg_name,
|
|
const struct crypto_type *frontend, u32 type, u32 mask);
|
|
|
|
int crypto_probing_notify(unsigned long val, void *v);
|
|
|
|
unsigned int crypto_alg_extsize(struct crypto_alg *alg);
|
|
|
|
int crypto_type_has_alg(const char *name, const struct crypto_type *frontend,
|
|
u32 type, u32 mask);
|
|
|
|
static inline struct crypto_alg *crypto_alg_get(struct crypto_alg *alg)
|
|
{
|
|
refcount_inc(&alg->cra_refcnt);
|
|
return alg;
|
|
}
|
|
|
|
static inline void crypto_alg_put(struct crypto_alg *alg)
|
|
{
|
|
if (refcount_dec_and_test(&alg->cra_refcnt) && alg->cra_destroy)
|
|
alg->cra_destroy(alg);
|
|
}
|
|
|
|
static inline int crypto_tmpl_get(struct crypto_template *tmpl)
|
|
{
|
|
return try_module_get(tmpl->module);
|
|
}
|
|
|
|
static inline void crypto_tmpl_put(struct crypto_template *tmpl)
|
|
{
|
|
module_put(tmpl->module);
|
|
}
|
|
|
|
static inline int crypto_is_larval(struct crypto_alg *alg)
|
|
{
|
|
return alg->cra_flags & CRYPTO_ALG_LARVAL;
|
|
}
|
|
|
|
static inline int crypto_is_dead(struct crypto_alg *alg)
|
|
{
|
|
return alg->cra_flags & CRYPTO_ALG_DEAD;
|
|
}
|
|
|
|
static inline int crypto_is_moribund(struct crypto_alg *alg)
|
|
{
|
|
return alg->cra_flags & (CRYPTO_ALG_DEAD | CRYPTO_ALG_DYING);
|
|
}
|
|
|
|
static inline void crypto_notify(unsigned long val, void *v)
|
|
{
|
|
blocking_notifier_call_chain(&crypto_chain, val, v);
|
|
}
|
|
|
|
#endif /* _CRYPTO_INTERNAL_H */
|
|
|